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Abstract 

We give two characterizations of crooked functions: one based on the minimum 
distance of a Preparata-like code, and the other based on the distance-regularity of a 
crooked graph. 

1 Introduction 

Highly nonlinear functions over finite vector spaces have attracted much interest in the 
last several years, for both their applications to cryptography (see [H] for example) and 
their connections to a variety of different combinatorial structures. The functions that 
are furthest from linear are called perfect nonlinear, unfortunately, none exist for binary 
vector spaces, which are the most cryptographically useful. However functions do exist 
in several lesser categories of nonlinearity, such as almost perfect nonlinear, almost bent, 
and crooked. We focus on the latter, which is the most specialized of the three. 

Crooked functions were introduced by Bending and Fon Der Flaass [2], who, build- 
ing on the graphs of de Caen, Mathon and Moorhouse [9], showed that every crooked 
function defines a distance-regular graph of diameter 3 with a particular intersection 
array. Shortly thereafter, van Dam and Fon Der Flaass [14] observed that every crooked 
function defines a binary code of minimum distance 5, similar to the classical Preparata 
code. In this paper, we show that the converse of each of these results is also true: 
crooked functions can be characterized using both Preparata-like codes (Theorem [3]) 
and distance-regular graphs (Theorem [5]). Those codes and graphs offer a more combi- 
natorial way of understanding the nature of nonlinear binary functions. 



2 Almost Perfect Nonlinear Functions 

Before considering crooked functions we need to characterize a more general class, 
namely almost perfect nonlinear functions. Throughout this article, let V :— V(m, 2), 
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a vector space of dimension m over F2, with m odd. Given a function / : V — > V, 
consider the following system of equations: 

{ m +m = 1 } • (1) 

Note that solutions to JT]) come in pairs: if (x, y) is a solution, then so is (y, x). If / is a 
linear function, then equation (fTJ) has 2 m solutions when b = f(a). We say / is almost 
perfect nonlinear if, for every (a, b) ^ (0,0), the system has at most two solutions. 
Equivalently, / is almost perfect nonlinear if and only if for all a ^ in V , the set 

Ha(f) :={f(x) + f(x + a)\xeV} 

has cardinality 2 TO_1 . 

We may construct a binary code from a function on V in the following manner. 
Identify V with the finite field ¥2^ , and let a be a primitive element of F2™ . Also let 
n = 2™ — 1, and assume / : V — > V is a function such that /(0) = 0. We define a parity 
check matrix Hf by 

1 a a 2 ... a™" 1 \ 
/(l) /(a) /(a 2 ) ... /(a"" 1 )/ ' 

and define the code Cf to be the kernel of Hf over F2. 

The code Cf can be thought of as a generalization of the double error-correcting 
BCH code, which is the specific case of f(a) := a 3 . It is clear from the parity check 
matrix that the minimum distance of Cf is at least 3, and it can be shown that the 
minimum distance is at most 5. The following characterization is due to Carlet, Charpin, 
and Zinoviev [7J Theorem 5]. 

Theorem 1. The minimum distance of Cf is 5 if and only if f is almost perfect 
nonlinear. In this case, the dimension of Cf is 

k = 2 m - 2m - 1. 

In the next section, we give a similar characterization of crooked functions, which 
are a special class of almost perfect nonlinear functions. 




3 Crooked Functions and Preparata-like Codes 

A function / : V — > V is crooked if the following three conditions hold: 

1. /(0) = 0; 

2. f(x) + f(y) + f(z) ^ f(x + y + z) for distinct x, y, and z; 

3. f{x) + f(y) + f(z) f{x + a) + f(y + a) + f(z + a) for all a ? 0. 

Condition [3 is equivalent to almost perfect nonlinearity; thus every crooked function 
is almost perfect nonlinear. Condition [3] states that for every a ^ 0, no three points 
in H a (f) are collinear. It follows that / is crooked if and only if /(0) = and H a (f ) 
is the complement of a hyperplane for all a ^ 0. Note that we are using the original 
definition of crooked functions given in [2], rather than the generalization appearing in 
Byrne and McGuire [5] or Kyureghyan [T2] . 
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The canonical example of a crooked function is the Gold function. Identify V with 
F 2 n« for odd to; then f(x) := x 2 +1 is called a Gold function if gcd(fc, to) = 1. More gen- 
erally, f(x) :— x 2 +2J is crooked provided that gcd(/c — j, to) = 1, and Kyureghyan [T2] 
has shown that all crooked power functions have this form. For recent progress in con- 
structing nonlinear functions which are not equivalent to the Gold functions, see [H [51 

hdj. 

Just as almost perfect nonlinear functions give rise to BCH-like codes, crooked func- 
tions give to Preparata-like codes. Given / : V — > V such that /(0) = 0, let Pf be the 
code whose codewords are the characteristic vectors of (S,T), for S C V* and T C V, 
such that the following three conditions hold: 

• \T\ is even, 

• r = r, and 

reS r£T 

• f(Yr)=yj(r) + Yj(r). 



reS reS reT 

Identifying V with F2™, we get the actual Preparata code when f(x) := x 3, and the 
generalized Preparata code when f(x) — x 2> " +1 (see [1]). In general Pf is not linear, 
and it is easy to verify that Pf always has minimum distance at least 3. The following 
result is due to Van Dam and Fon Der Flaass [HJ Theorem 7]. 

Theorem 2. If f is crooked, then Pf has minimum distance 5 and size 2 2 + ~ 2 ™ l ~ 2 . 

If Pf has minimum distance 5, then it is nearly perfect: it satisfies the Johnson 
bound [131 Theorem 17.13] with equality. Hence Pf has minimum distance at most 5 
for any /. We show the converse of Theorem [2j 

Theorem 3. If Pf has minimum distance 5, then f is crooked. 

Proof. We assumed in the definition of Pf that /(0) = 0, so condition Q] of crookedness 
is satisfied. If Pf has minimum distance 5, then there is no pair (<fi, T) in Pf with 
\T\ = 4. That is, for any distinct w, x, y, z such that w + x + y + z = 0, 

f(w) + f(x) + f(y) + f{z) + 0. (2) 

Thus condition [2] of crookedness is also satisfied, and it remains to show condition [3l 
Since condition [2] is saitsfied, / is almost perfect nonlinear and Cf has dimension 2 m — 
2m — 1 by Theorem [TJ But Cf is the kernel of Hf, so it follows that Hf has a column 
space of dimension 2m, namely V x V. This implies that for any (a, b) in V x V, there 
is a subset S of V* such that 



5>> £/m) 

\reS res J 



(a,b). (3) 



Given any x € V, let T = {x, 0}, so that \T\ is even and X^er 7 " = x - Then from 
equation there exists some S C V* such that 



(E r <E/w) =M)- 



res res 
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Choosing S in this way, (S, T) is in Pf. Now given any y, z and a ^ 0, consider 

{S', T') := (S © {y} © + a}, T © {z} © {z + a}). 

This vector is at distance 4 from (S,T). Since Pf has distance 5, (S',T') must not be 
in Pf. But |T'| is even, and 

E r = E r; 

hence for (S',T') ^ it must be the case that 



rGS' r£S' rST' 



This implies 

f( x + a)^J2 /W + /(w) + /(y + «) + E + /(*) + /( z + °)< 

or in other words 

f{x + a)^ f(y) + f(y + a) + f(x) + f(z) + f(z + a). 
Thus condition [3] of crookedness is satisfied for /. □ 

4 Crooked Graphs 

As usual, assume /(0) = 0. Define the crooked graph of /, denoted Gf, to have vertex 
set V x F 2 x V with the following adjacency condition: distinct (a, i, a) and (b, j, (3) are 
adjacent if and only if 

a + /3 = f(a + b) + (i + j + l)(/(o) + /(&)). 

It is not difficult to show that any two vertices in the subset 

F m ■= {(a,i,a) \a <EV} 

are at distance at least three, and that any two distinct subsets F a i and F j are joined 
by a perfect matching. It follows that Gf is a 2 m -cover of the complete graph Kim+i, 
and each F a i is a fibre (for background on covers of complete graphs, see [H]). The 
following theorem is given by Bending and Fon-Der-Flaass [2j Proposition 13]. 

Theorem 4. /// is crooked, then Gf is an antipodal distance-regular graph with inter- 
section array 

| 2 m+l _ 2 m+l _ 2] 1; 1; ^ 2 m+l _ ^ 

For background on distance-regular graphs, see [3]. Again, we show the converse. 
Theorem 5. If Gf is distance-regular with intersection array 

| 2 m+l _ 1) 2 m + l _ 2j 1; ^ 2^ 2 m+l _ 

then f is crooked. 



4 



Proof. For convenience, consider the graph G'f which consists of Gf with a loop added 
to every vertex. This can be done by removing the restriction (a, i,a) ^ (b,j,/3) from 
the adjacency condition of Gf. If Gf is distance- regular with ai = and C2 = 2. 
then G"y is a graph with the property that any two vertices at distance 1 or 2 have 
exactly two common neighbours. That is, for any two vertices (a 7 i,a),(b,j,(3) such 
that (a,i) (b,j), there are exactly two vertices (c, k,j) such that 

a + 7 = f{a + c) + (i + k + l)(/(a) + /(c)), (4) 
+ 7 = /(& + c) + (j + fc + l)(/(6) + /(c)). (5) 

We restrict our attention to the cases in which i = j, so that a ^ b. Adding (|U) and 
together, there are exactly two pairs (c, k) such that 

a + 13 = f(a + c) + f(b + c) + (i + k + l)(/(a) + /(&)). 

Running over all values of a + 0, we see that for fixed (a, b, i), the multiset 

{/(a + c) + f(b + c) + (i + k+ l)(/(a) + /(&)) I c G y, fe 6 F 2 } 

= {f(a + c) + f(b + c) \ c EV}U {f(a + c) + f(b + c) + f(a) + f(b) \ c EV} (6) 

contains each element of V exactly twice. 

Now for some fixed c, consider f(a + c) + f(b + c). Letting c' := c + a + b, we have 

f(a + c) + f(b + c) = f(a + c') + f(b + J). 

However, the value f(a + c) + f(b + c) only occurs twice in ([6]), so there is no third 
solution c" ^ c, c' such that 

/(a + c) + /(& + c) = /(a + c") + f(b + c"). 

In other words, letting x = a + c, y = b + c, and z = a + c", we have 

/(z) + /(y)^/(*) + /(z + y + z) 

for z x,y. This is condition [2] of crookedness for /. Also because /(a + c) + f(b + c) 
has already occured twice in ((6]), there is no c" such that 

f(a + c) + /(& + c) = f(a + c") + f(b + c") + /(a) + f(b). 

Setting x = a + c, y = a + c" , z = a and w = a + 6, we have 

/(*) + /(.x + W ) ^ /(y) + /(y + w) + f(z) + f(z + w) 

for any x,y, z and w, with w =/= 0. This is the condition [3] of crookedness, so / is 
crooked. □ 
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